name: servicemap

services:
  servicemap:
    build:
      context: .
      dockerfile: Dockerfile.unraid
    container_name: servicemap
    restart: unless-stopped
    environment:
      SERVICEMAP_DB: /data/servicemap.db
      SERVICEMAP_STATIC_DIR: /app/static
      SERVICEMAP_PROBE_INTERVAL: ${SERVICEMAP_PROBE_INTERVAL:-60}
      SERVICEMAP_PROBE_TIMEOUT: ${SERVICEMAP_PROBE_TIMEOUT:-5}
      SERVICEMAP_PROBE_RETRIES: ${SERVICEMAP_PROBE_RETRIES:-1}
      SERVICEMAP_PROBE_CONCURRENCY: ${SERVICEMAP_PROBE_CONCURRENCY:-10}
      SERVICEMAP_RETENTION_DAYS: ${SERVICEMAP_RETENTION_DAYS:-30}
      SERVICEMAP_EVENT_RETENTION_DAYS: ${SERVICEMAP_EVENT_RETENTION_DAYS:-90}
      SERVICEMAP_TLS_WARNING_DAYS: ${SERVICEMAP_TLS_WARNING_DAYS:-30}
      SERVICEMAP_FLAP_THRESHOLD: ${SERVICEMAP_FLAP_THRESHOLD:-6}
      SERVICEMAP_DISCOVERY_INTERVAL_SECONDS: ${SERVICEMAP_DISCOVERY_INTERVAL_SECONDS:-0}
      SERVICEMAP_OBSERVATION_INTERVAL_SECONDS: ${SERVICEMAP_OBSERVATION_INTERVAL_SECONDS:-60}
      SERVICEMAP_DOCKER_HOST: ${SERVICEMAP_DOCKER_HOST:-unix:///var/run/docker.sock}
      # "broker" is opt-in and has no socket fallback.  It requires a dedicated
      # registered ServiceMap identity and token file before activation.
      SERVICEMAP_DOCKER_PROVIDER: ${SERVICEMAP_DOCKER_PROVIDER:-socket}
      SERVICEMAP_DOCKER_BROKER_URL: ${SERVICEMAP_DOCKER_BROKER_URL:-}
      SERVICEMAP_DOCKER_BROKER_TOKEN_FILE: ${SERVICEMAP_DOCKER_BROKER_TOKEN_FILE:-}
      SERVICEMAP_APPOPS_URL: ${SERVICEMAP_APPOPS_URL:-}
      SERVICEMAP_PROBE_HOST: ${SERVICEMAP_PROBE_HOST:-}
      # Disabled is backwards-compatible. OIDC mode is fail-closed and needs
      # issuer, audience and explicit role-group mappings before activation.
      SERVICEMAP_AUTH_MODE: ${SERVICEMAP_AUTH_MODE:-disabled}
      SERVICEMAP_OIDC_ISSUER: ${SERVICEMAP_OIDC_ISSUER:-}
      SERVICEMAP_OIDC_AUDIENCE: ${SERVICEMAP_OIDC_AUDIENCE:-}
      SERVICEMAP_OIDC_ROLE_CLAIMS: ${SERVICEMAP_OIDC_ROLE_CLAIMS:-groups,roles}
      SERVICEMAP_OIDC_VIEWER_GROUPS: ${SERVICEMAP_OIDC_VIEWER_GROUPS:-}
      SERVICEMAP_OIDC_OPERATOR_GROUPS: ${SERVICEMAP_OIDC_OPERATOR_GROUPS:-}
      SERVICEMAP_OIDC_ADMIN_GROUPS: ${SERVICEMAP_OIDC_ADMIN_GROUPS:-}
    volumes:
      - servicemap_data:/data
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "${SERVICEMAP_PORT:-1253}:8000"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3).read()"]
      interval: 20s
      timeout: 5s
      start_period: 10s
      retries: 5
    labels:
      net.unraid.docker.managed: "dockerman"
      net.unraid.docker.webui: "http://${SERVICEMAP_WEBUI_HOST:-127.0.0.1}:${SERVICEMAP_PORT:-1253}"
      net.unraid.docker.icon: "http://${SERVICEMAP_WEBUI_HOST:-127.0.0.1}:${SERVICEMAP_PORT:-1253}/icons/servicemap-dockerman-256.png"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=32m
    logging:
      driver: json-file
      options:
        max-size: "20m"
        max-file: "3"

volumes:
  servicemap_data:
    name: servicemap_data